Critical Alert: CVE-2026-3300 allows remote code execution on Everest Forms Pro and already creates administrative accounts on WordPress

A critical vulnerability identified as CVE-2026-3300 in the Everest Forms Pro commercial complement is being actively exploited to achieve remote code execution on WordPress sites, allowing attackers to create administrative accounts and take full control of vulnerable facilities. The weakness lies in the "Complex Calculation" function of the plugin, which contains values introduced by users within a PHP chain and evaluates that result with oval (), an inherently dangerous practice when unreliable data are mixed.

The failure affects versions 1.9.12 and above; although the plugin applies sanitize _ text _ field () At the entry, this function does not escape simple quotes or other characters that alter PHP syntax, allowing an attacker to close the expected chain, inject arbitrary PHP code (for example, a call to wp _ insert _ user ()) and neutralize the rest of the code with a comment. In practice this has served malicious operators to create the administrative account with the name detected recurently "diksimarina."

The reporting and patch cycle took place quickly: vulnerability was reported through Wordfence and the developer published a patch on March 18. Still, according to Wordfence's telemetry, active exploitation began on April 13 and firewall has already blocked tens of thousands of attempts in protected facilities. Wordfence has published a technical analysis and recommendations that should be reviewed: WordPress report on CVE-2026-3300.

The implications for operators and site owners are serious: an administrative account allows to modify content, install or remove plugins and themes, plant back doors or webshells, extract or manipulate databases and pivote within the hosting infrastructure. For customer sites or e-commerce this can mean data loss, fraudulent billing, listed in engines like malware distributors and regulatory sanctions if there is personal data exposure.

If you manage a site with Everest Forms or its Pro version, immediate and priority action is to update the plugin to the parcheed version. If you cannot apply the update immediately, disable or remove the add-on Pro until you confirm the mitigation. Check the official plugin page and WordPress directory to check versions and notices: Everest Forms on WordPress.org.

In addition to updating, it does a focused search and cleaning: it inspects records (accs.log and error.log) for unusual requests to forms containing quotes and calls to wp _ insert _ user, looks for new or suspicious administrative accounts (especially "diksimarina"), runs WordPress-focused malware scans (e.g. Wordfence, Sucuri or similar tools) and reviews the file system by recently modified PHP files or webshells. If you suspect commitment, consider restoring the credentials of administrators and access to the hosting from a verified, clean backup.

Do not ignore additional preventive measures: it applies the principle of minor privilege in WordPress roles, requires multifactor authentication for high-permissions accounts, monitors file integrity and programmed tasks (cron) and places a web application firewall (WAF) to block known operating patterns. Wordfence identifies frequent source addresses of attacks and recommends their blocking as a temporary measure: among them are 202.56.2 [.] 126 and 209.146.60.26; however, depending only on IP blockages is insufficient against campaigns that rotate infrastructure.

At the technical and development level, this incident recalls a basic rule: never evaluate code built from user entries. The functions that interpret or execute chains as a code should be avoided or limited to sandboxing and strict validation controlled environments. Plugin holders should audit functions that rely on eval () or dynamic execution and provide safe alternatives for calculation and logic in forms.

To stay informed and coordinate responses, consult official sources and vulnerability databases: the CVE registry offers the identifier and technical context when available ( CVE-2026-3300 in NVD), and review the telemetry and block analysis of Wordfence to detect operating patterns. If you manage many sites, automate the detection of vulnerable versions and updates, and consider periodic third-party security audits to reduce the exposure window to similar failures.

In short: it updates as soon as possible, inspects by commitment signals (especially new administrative accounts), strengthens authentication and price controls, and avoids code practices that allow you to run user entries as a code. Acting quickly reduces the likelihood that a recent explosion will become a persistent and costly intrusion.